[SoX-devel] [PATCH] hcom: fix double free on writing zero-length file

[Mans Rullgard]

---
src/hcom.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/hcom.c b/src/hcom.c
index e76820e..c62b020 100644
--- a/src/hcom.c
+++ b/src/hcom.c
@@ -432,9 +432,10 @@ static int stopwrite(sox_format_t * ft)
int rc = SOX_SUCCESS;

/* Compress it all at once */
- if (compressed_len)
+ if (compressed_len) {
compress(ft, &compressed_data, (int32_t *)&compressed_len);
- free(p->data);
+ free(p->data);
+ }

/* Write the header */
lsx_writebuf(ft, "\000\001A", (size_t) 3); /* Dummy file name "A" */

[Eric Wong]

Post by Mans Rullgard
+++ b/src/hcom.c
@@ -432,9 +432,10 @@ static int stopwrite(sox_format_t * ft)
int rc = SOX_SUCCESS;
/* Compress it all at once */
- if (compressed_len)
+ if (compressed_len) {
compress(ft, &compressed_data, (int32_t *)&compressed_len);
- free(p->data);
+ free(p->data);
+ }

Tested successfully with: sox $INPUT x.hcom trim 0

A side note: As somebody who has never heard of hcom until now, much
less read the code, it was not immediately obvious to me what the
problem was or whether it introduced a new leaks until I skimmed through
the entire stopwrite and compress functions :x

------------------------------------------------------------------------------